fix: fail the render when dex.github.orgs is empty

[venkatamutyala]

Into #1485, not main. One template guard.

The problem

dex.github.orgs is optional today:

templates/application-dex.yaml:63-68
  {{- if .Values.dex.github.orgs }}
  orgs:
  ...
  {{- end }}
  loadAllGroups: true

But it is the only thing restricting who Dex admits. Dex v2.44.0 connector/github/github.go:

func (c *githubConnector) getGroups(ctx, client, groupScope bool, userLogin string) {
	switch {
	case len(c.orgs) > 0:               return c.groupsForOrgs(...)   // only branch that can deny
	case c.org != "":                   return c.teamsForOrg(...)
	case groupScope && c.loadAllGroups: return c.userGroups(...)      // ← lands here
	}

groupsForOrgs is the sole source of github: user %q not in required orgs or teams (github.go:375). With the list empty that branch is unreachable, and because this chart sets loadAllGroups: true, control falls to userGroups — which returns the caller's groups and cannot return an error. Every GitHub account authenticates.

Nothing downstream catches it: oauth2-proxy runs email_domains=["*"] with no allowed_groups.

Scope of the exposure, precisely

• The edge: fully open. Including the five hosts with no auth of their own — goldilocks, cluster-info, and the three Traefik dashboards, whose /api/rawdata lists every router, service, middleware and TLS config on the cluster.
• OpenBao: still gated. The jwt roles' bound_claims require group membership, so a stranger gets no policy.
• ArgoCD: depends on the tenant's rendered policy.csv, which is group-keyed.

So this is the edge, not all three — worth stating accurately, because the cluster reports Synced/Healthy throughout and nothing indicates it is open.

Why this is a footgun, not a live hole

values.yaml ships two placeholder orgs, so the default is safe. Reaching the bad state needs a tenant to override orgs to empty or null. The reason to guard it anyway is that the failure is silent and total.

This is pre-existing, not introduced by #1485. It rides along here because #1485 is what makes a Dex-issued token valuable enough to matter: toolbox is the first public client on this platform whose audience anything honors.

Why fail/not and not required

required rejects only nil and the empty string — an empty list passes straight through. Demonstrated:

# values: orgs: []
{{ required "REQUIRED FIRED" .Values.orgs }}   ->  renders  a: []
{{- if not .Values.orgs }}{{ fail "…" }}{{ end }}  ->  Error: FAIL/NOT FIRED

not is falsy for nil, empty list and empty string alike.

(#1485's description currently suggests required for this. That suggestion was mine and it was wrong; I'll correct it there.)

Verification

case	expected	result
default values	renders	✅ renders, orgs: unchanged
dex.github.orgs=["acme"]	renders	✅
dex.github.orgs=[]	abort	✅ dex.github.orgs must be non-empty: it is the only restriction on who Dex admits
dex.github.orgs=null	abort	✅

🤖 Generated with Claude Code

https://claude.ai/code/session_01TrpnuCduw2KivngVRQmnG7